Deploying Defender for Office 365

In the previous chapter, we discussed how to implement Exchange Online Protection (EOP), which is the backbone feature of email security in Microsoft 365. This chapter will focus on deploying Microsoft Defender for Office 365 (MDO), which is the modern email and collaboration security product relying on machine learning and artificial intelligence (AI) to identify and remediate threats.

We will cover these main topics throughout the chapter:

• What is MDO?
• Features of MDO
• Present security policies in MDO
• Deploying MDO

What is Microsoft Defender for Office 365?

MDO is the security service in Microsoft 365 dedicated to protecting our systems against advanced threats via email and collaboration tools such as Microsoft Teams, SharePoint Online, and OneDrive for Business. The service is cloud-based, and the infrastructure behind it is governed and administrated by Microsoft as a part of its cloud security offering.

What differentiates MDO from traditional email security solutions is that it has the capability to perform sandbox detonation on any incoming email and/or attachment to prevent malicious artifacts from landing on the end user’s system. The service also monitors any links received by a user to make sure that any illicit links are not reachable, as well as automated investigation and response (AIR), and, of course, advanced hunting capabilities.

Combining these features together, the attack vectors of email and collaboration threats are greatly minimized as the most common threats...

Exploring the features of MDO

As mentioned in the introduction of this chapter, MDO has some cool features that help protect organizations from more advanced email-based and collaboration threats. These features are detailed here:

• Safe Links
• Safe Attachments
• Impersonation protection

To better understand these features, let us look at them individually, starting with Safe Links.

Safe Links

Safe Links provides time-of-click verification of URLs in incoming email messages, Teams messages, and Office files. This is done via URL scanning and rewriting of links in inbound email messages and in other Office files opened in Office applications such as Word, Outlook, or Teams messages to ensure that the URL in question is a legitimate URL and not a link for a malicious site. Safe Links operates in addition to the regular anti-spam, anti-phishing, and anti-malware policies in EOP. The feature will help protect your organization from user misclicks on malicious links...

Exploring preset security policies

Just like EOP, MDO has several built-in policies that allow you to be protected on a general level from the get-go. To ensure that customers host their data in Microsoft 365, Microsoft provides preset security policies in MDO that, when followed, greatly improve the security posture without an administrator having to learn in detail how to configure each setting in the service.

The drawback of these policies is that they offer very limited possibilities for customizations, which is, of course, something that most organizations are looking for to ensure the business continuation and minimize the risk of adverse effects on the environment due to a security service malfunctioning.

There are two different preset security policies:

• Standard protection: This contains baselines that are suitable for most users in an organization
• Strict protection: These are more aggressive protection baselines than in standard and are more suitable for...

Deploying custom policies in MDO

Let us look at how to deploy our own custom policies in MDO because, as stated in the Preset security policies section, these might not fit your needs as they provide very limited options for customization:

1. Start by navigating to the Microsoft 365 Defender portal at https://security.microsoft.com.
2. On the left-hand side of the screen, navigate to Email & collaboration | Policies & rules:

Figure 15.5 – Accessing the settings for Policies & rules in the Microsoft 365 Defender portal

3. Click on the section named Threat policies:

Figure 15.6 – Accessing Threat policies

4. You could use the shorter way as well; the URL for these settings is https://security.microsoft.com/threatpolicy.
5. This is where all the policies we talked about in the Preset security policies section and all the settings for Safe Links, Safe Attachments, and impersonation...

Summary

This chapter is meant as a comprehensive guide that explains the process of setting up and configuring MDO. This cloud-based security solution is designed to safeguard Office 365 users from various types of advanced cyber threats, including phishing, malware, and zero-day attacks. The chapter covered key aspects of the deployment process, including setting up and configuring MDO, managing threat detection policies, and configuring reports and alerts. By following the instructions in this chapter, organizations can deploy MDO and provide their users with comprehensive and effective protection against advanced cyber threats. In the next chapter, we will shift focus to Microsoft Defender for Cloud Apps.

Questions

If you want to see how much you’ve learned after studying this chapter, have a go at the following questions:

1. How does Safe Attachments verify that an attachment is safe?
   1. Signature-based scanning
   2. Third-party anti-virus scanning
   3. Cloud-based sandboxing
2. A user tries clicking on a link received in an email, which is known to be bad. Would Safe Links allow the user to click through the warning?
   1. No, this is prohibited based on Secure by Default design principles
   2. Yes, users can always click through a Safe Links warning
   3. Maybe, it depends on the Allow user to click through warning setting
3. True or false? Microsoft Defender for Office 365 replaces Exchange Online Protection for cloud-enabled mailboxes:
   1. True
   2. False

Further reading

You may refer to the following links to expand your knowledge on the topics explored in this chapter:

• https://www.powershellgallery.com/packages/ORCA
• https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/protection-stack-microsoft-defender-for-office365?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-about?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide
• https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide